Start Submit a site

JWT Decoder

Developer Tools

Paste a JSON Web Token to read its header, payload and exact expiry time — decoded locally, so the token never leaves your browser.

Your inputs

Browse all tools

Paste the whole three-part token, including both dots.

Result

Status —
  • Expires —
  • Algorithm —
  • Token type —
  • Payload —
  • Header —

Change any input and the result updates instantly.

Formula and rules

  • A JWT carries three Base64URL parts separated by dots: header, payload and signature.
  • Base64URL swaps + for - and / for _, and drops the = padding, so tokens survive URLs and HTTP headers.
  • The exp claim is a Unix timestamp in seconds, so a token is expired once the current time passes that number.
  • Decoding only reads the two JSON parts; it never checks the signature, which the server must verify.

Worked examples

Decode a demo token

Input The prefilled token, exp = 1700003600.

Result Algorithm HS256, type JWT, four claims, expiry 2023-11-14 23:13:20 UTC.

A token without exp

Input A payload of {"sub":"42","scope":"read"}.

Result The status reads that the token has no expiry claim, so it never lapses on its own.

A truncated token

Input abc.def

Result An error explains that a JWT must have three parts before anything can be decoded.

FAQ

Does decoding prove the token is genuine?

No. Anyone can craft a token with any payload they like. Only a server that verifies the signature with the secret or public key can tell whether a token was issued by you.

Is it safe to paste a production token?

Decoding happens in your browser, so the token is not uploaded. Treat it like a password anyway: prefer a test token, and rotate anything you paste into a shared screen.

Why is a fresh token already expired?

Either the issuer clock is behind yours, or an exp value in milliseconds was passed where seconds are expected. This tool reads exp as seconds, matching the JWT specification.

What if the header or payload is not JSON?

The decoder reports an error. The JWT specification requires both parts to be base64url-encoded JSON objects, so a non-JSON part usually means the string is not a JWT at all.

Disclaimer: Results follow the formula shown on this page and are for reference only. Real-world quantities vary with materials, technique and conditions, so allow a margin before ordering.